gdpr-audit-prep

name: gdpr-audit-prepdescription: >  GDPR audit-prep playbook: sprint to prepare for a supervisory authority inquiry,  DPA audit, or internal review. Use when an audit is scheduled, when readiness gaps  surface, or when ROPA (Records of Processing Activities) needs completion.license: MIT + Commons Clausemetadata:   version: 1.0.0  author: borghei  category: compliance  domain: ra-qm-team  updated: 2026-05-27  tags: [gdpr, audit-prep, ropa, dpia, data-protection, dpo-engagement, eu-privacy]

GDPR Audit Prep

Operational playbook for GDPR audit preparation — whether triggered by a Data Protection Authority (DPA) inquiry, customer-side DPA review, internal compliance audit, or annual self-assessment.

When to use this skill vs. gdpr-dsgvo-expert:

• This skill: audit imminent (4-12 weeks); need execution sprint
• gdpr-dsgvo-expert: building GDPR program; designing DPIA process; multi-quarter

---

When to use this skill

---

The audit-prep sprint at a glance

4-week sprint (well-prepared org, periodic review)

Week 1: ROPA review + DPO engagement plan
Week 2: Gap remediation (policies, notices, technical)
Week 3: Evidence compilation + walkthroughs
Week 4: Audit week / submission

8-week sprint (gaps remaining)

Weeks 1-2: ROPA update + gap identification
Weeks 3-5: Gap closure (DPAs, notices, security, retention)
Weeks 6-7: Evidence + walkthroughs
Week 8: Audit

12-week sprint (DPA inquiry response)

Weeks 1-2: Inquiry analysis + response strategy + DPO engagement
Weeks 3-8: Targeted evidence collection + remediation
Weeks 9-10: Formal response drafting + legal review
Weeks 11-12: Submission + ongoing dialogue

See references/gdpr-pre-audit-checklist.md for the full pre-audit punch list and references/dpo-engagement-playbook.md for DPO-coordinated audit response.

---

Critical GDPR audit areas

1. ROPA (Records of Processing Activities, Article 30)

Every processing activity documented:

• Purpose of processing
• Categories of data subjects + data types
• Recipients (internal + external)
• International transfers (and lawful basis)
• Retention periods
• Security measures
• Lawful basis (consent, contract, legitimate interest, etc.)
• DPIA reference (if high-risk)

Audit gap: ROPA incomplete, stale, or missing for processing activities surfaced during audit.

2. Privacy Notices (Article 13/14)

• Privacy notice published + current
• Contains all required information (data controller, purposes, lawful basis, retention, rights, complaints contact, etc.)
• Easily accessible (no dark patterns)
• Translated for EU member states (where required)

3. Data Subject Rights (Article 12-23)

• Process documented + tested
• Response time tracked (< 1 month standard; extension possible)
• Identity verification
• Records of requests and responses (last 12 months)

4. Data Protection Impact Assessments (DPIAs, Article 35)

• High-risk processing activities identified
• DPIA conducted for each
• Mitigations documented
• DPO consulted (Article 35.2)

5. Data Processing Agreements (Article 28)

• DPA with every processor (vendor, sub-service org)
• Covers required clauses (Article 28.3)
• Annual review

6. Security Measures (Article 32)

• Technical and organizational measures documented
• Risk-appropriate (encryption, access control, backup, etc.)
• Tested and reviewed

7. Breach Notification (Article 33/34)

• Process documented
• 72-hour authority notification capability
• Past-period breaches: notified appropriately + documented

8. International Transfers (Chapter V)

• Mechanism for each transfer (SCCs, BCRs, adequacy decision)
• Transfer Impact Assessment (TIA) for non-adequacy countries
• Schrems II compliance for US transfers

---

Clarify First

Before running the audit-prep, settle the inputs below. When one is missing or vague and would change the result, ask about it; when it wouldn't, use a sensible default and say which one you used.

• Audit trigger: supervisory-authority inquiry, customer DPA audit, internal audit, or annual self-assessment (sets the 4/8/12-week sprint and whether formal response drafting is needed).
• Org readiness: well-prepared vs gaps remaining (picks the 4-week vs 8-week sprint).
• Processing scope and role: controller vs processor, and which activities/ROPA are in scope (drives the ROPA and DPA focus).

Ask about the two or three inputs that matter most for this request, not the whole list. If the user wants a result straight away, produce it and state your assumptions at the top.

Quick start

1. Run readiness score: python3 scripts/gdpr_readiness_score.py --config gdpr-controls.yaml
2. Check ROPA completeness: python3 scripts/ropa_completeness_checker.py --ropa ropa.yaml
3. Engage DPO: Walk through findings with DPO; finalize sprint scope
4. Execute sprint per references/gdpr-pre-audit-checklist.md

---

Common GDPR audit failures

• ROPA missing or out-of-date. Often the first thing an auditor asks.
• Privacy notice generic — boilerplate not actually reflecting actual processing.
• DPIA missing for high-risk processing (AI / profiling / large-scale monitoring / sensitive data).
• DPAs not signed with all processors — easy oversight; substantial finding.
• International transfer mechanism unclear post-Schrems II.
• Breach notification process untested — first breach is the test.
• Consent not freely given — bundled consent, pre-ticked boxes, take-it-or-leave-it.
• No DPO appointed when required (Article 37 — public authority, large-scale monitoring, etc.).
• Data subject rights process untested — request comes in, no one knows what to do.

---

Tooling

---

Scope & Limitations

In Scope:

• GDPR audit-prep sprints of 4, 8 or 12 weeks for supervisory-authority inquiries, customer DPA audits, internal audits and annual self-assessments
• Readiness scoring (0-100) per GDPR area, with a sprint recommendation, from gdpr_readiness_score.py
• ROPA completeness checks per Article 30 from ropa_completeness_checker.py
• Audit checklists for ROPA, privacy notices, data subject rights, DPIAs, Article 28 agreements, security, breach notification and international transfers, plus a DPO engagement playbook

Out of Scope:

• Building a GDPR program or designing the DPIA process (see ra-qm-team/gdpr-dsgvo-expert/)
• Carrying out a DPIA (see legal/dpia-assessment/)
• US privacy laws (see ra-qm-team/ccpa-cpra-privacy-expert/)
• Running several frameworks in one program (see ra-qm-team/audit-prep/compliance-readiness/)

Important Caveats:

• Both tools read YAML you prepare. They check that fields are present and score what you report; they do not test processing, notices or security measures.
• A high score is not a supervisory authority's view and not legal advice. A formal inquiry response should go through your DPO and legal review, as the sprint plan sets out.
• Transfer mechanisms and regulator guidance change over time. Check current guidance before relying on a transfer assessment.

---

References

• gdpr-pre-audit-checklist.md — full checklist per GDPR area
• dpo-engagement-playbook.md — DPO-coordinated audit response

---

Related skills

• ra-qm-team/gdpr-dsgvo-expert — deep GDPR program management
• ra-qm-team/audit-prep/compliance-readiness — multi-framework readiness (GDPR + ISO 27001 + SOC 2)
• ra-qm-team/ccpa-cpra-privacy-expert — US privacy counterpart
• ra-qm-team/audit-prep/ai-act-readiness — EU AI Act overlay for AI processing